Critical Vulnerabilities in GitHub Copilot, Gemini CLI, Claude, and Other Tools Impact Millions of Users

The report details "IDEsaster," a vulnerability class where AI coding assistants integrated into IDEs can be coerced to overwrite global IDE configuration and workspace files, enabling remote code execution and data exfiltration; the research found over 30 issues with 24 CVEs assigned across major products (e.g., GitHub Copilot, Cursor, JetBrains Junie), and demonstrates attack chains that leverage IDE features like .vscode/settings.json and .idea/workspace.xml to execute malicious payloads.